How can T1027.017 be detected?

Detection of T1027.017 (SVG Smuggling) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.

What mitigations exist for T1027.017?

There are 1 documented mitigations for T1027.017. Key mitigations include: Application Isolation and Sandboxing.

Which threat groups use T1027.017?

While specific threat group attribution may vary, this technique has been observed in various real-world attacks. Check the MITRE ATT&CK website for the latest threat intelligence.

Home
ATT&CK Techniques
T1027
T1027.017

Stealth

T1027.017: SVG Smuggling

T1027.017 · Sub-technique ·3 platforms

Description

Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign SVG files.(Citation: Trustwave SVG Smuggling 2025) SVGs, or Scalable Vector Graphics, are vector-based image files constructed using XML. As such, they can legitimately include